.png)
If your business takes payments online, Strong Customer Authentication shapes how those payments go through. It is the reason customers are sometimes asked to approve a purchase in their banking app, and getting it right protects you from fraud and lost sales alike. This guide explains what Strong Customer Authentication and 3D Secure are, and what they mean for your business.
In short. Strong Customer Authentication, or SCA, is a rule requiring an extra identity check on most online card payments, delivered through 3D Secure. It cuts fraud and shifts the liability for fraudulent chargebacks to the card issuer, but a clumsy checkout can add friction and lose sales. The goal is to meet the rules while keeping the customer journey smooth.
Strong Customer Authentication comes from payment regulation designed to reduce online fraud. It requires that most online card payments are verified using at least two independent factors: something the customer knows, such as a password, something they have, such as their phone, and something they are, such as a fingerprint or face scan. Two of these three must be used.
In practice this is why, when paying online, a customer is often bounced to their banking app or sent a one time code to confirm the purchase. That extra step is SCA in action.
The technology that carries out this check is 3D Secure, now in its second generation. When a customer pays online, 3D Secure passes information to their bank, which decides whether to approve the payment outright or ask for an extra check such as a biometric approval in the banking app or a one time passcode.
The newer version is smart about it. It shares more data with the bank, so low risk payments can often be approved without the customer being challenged at all, while riskier ones get the extra step. Done well, most customers barely notice it.
✓ It reduces online card fraud by making stolen card details far harder to use.
✓ When a payment is authenticated with 3D Secure, liability for fraud chargebacks usually shifts to the card issuer, protecting you.
✓ A good checkout applies it smoothly, so genuine customers are rarely challenged.
✗ A poorly implemented checkout can add friction and cause customers to abandon a sale.
✗ Skipping 3D Secure to reduce friction, which can leave you carrying fraud liability you could have avoided.
Not every payment needs the extra check, and the rules include exemptions that keep low risk payments smooth. Small value payments below a set threshold can be exempt. Low risk payments identified by transaction risk analysis can skip the step. Recurring payments of the same amount, and payments to a merchant the customer has added as trusted, can also be exempt. A good payment provider applies these automatically, challenging customers only when needed.
It is worth being clear that SCA mainly concerns online, card not present payments. In person, chip and PIN already provides two factor authentication, the card the customer has and the PIN they know, so a normal in store card payment is not affected in the same way. The friction question is really an online checkout question, which is where the effort to get it right pays off.
For most businesses SCA is handled by their payment provider or checkout rather than something they build themselves. The job is to make sure your provider supports the current version of 3D Secure and applies the exemptions intelligently, so genuine customers sail through and only risky payments get challenged. The businesses that lose sales to SCA are usually those on an older or poorly configured checkout, not those following the rules.
Think of Strong Customer Authentication as protection you want, not a hurdle to dodge. Authenticated payments shift fraud liability away from you, and a modern checkout applies the checks so lightly that most customers never notice. The aim is a checkout that is secure and smooth at the same time, which a good provider delivers by default.
1. Your provider supports current 3D Secure. Confirm your online checkout uses the latest version, which challenges customers far less often.
2. Exemptions are applied. Make sure low value and low risk payments are not challenged unnecessarily.
3. The checkout is smooth. Test paying on your own site to see how often and how heavily customers are challenged.
4. You are keeping the liability protection. Using 3D Secure properly shifts fraud chargeback liability to the issuer, so do not switch it off to save a step.
A rule requiring most online card payments to be verified with two independent factors, such as a password and a phone approval, to cut fraud. It is delivered through 3D Secure.
The technology that carries out the authentication check, passing information to the customer bank, which approves the payment or asks for an extra step such as a biometric or a one time code.
Mainly no. Chip and PIN in store already provides two factor authentication, so SCA is chiefly about online, card not present payments.
Only if your checkout applies it poorly. A modern 3D Secure setup challenges customers rarely and lightly, so genuine buyers are seldom interrupted.
Usually yes. When a payment is authenticated through 3D Secure, liability for fraudulent chargebacks typically shifts to the card issuer rather than you.
Usually not. Your payment provider or checkout handles Strong Customer Authentication and 3D Secure for you behind the scenes. Your job is to make sure the provider supports the current version and applies the exemptions sensibly, then to test your own checkout so you can confirm genuine customers are only rarely interrupted.